feat(auth): gate and regate freight API controllers

Gates the previously open support-agent, procurement, compliance,
facilities, list-users and trade-access controllers, separates customer
from staff routes across bookings, contracts, companies, billing,
warehouses, files and train scheduling, and moves billing, overview,
reports and the settings controllers onto their own keys instead of the
blanket admin key. Drops the demo-permissions module and the untested
notification test route.

apps/edr-freight-api/src/modules/support-chat/support-attachment.controller.ts

@@ -18,10 +18,12 @@ import {
 } from "@nestjs/swagger";
 import { Response } from "express";
 
+import { MixedAudience } from "../../common/booking-guards";
 import {
   AuthUserPayload,
   resolveAuthUserId,
 } from "../../common/resolve-auth-user-id";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { FilesService } from "../files/files.service";
 import { SupportChatService } from "./support-chat.service";
 
@@ -48,6 +50,7 @@ export class SupportAttachmentController {
   ) {}
 
   @Get(":fileId")
+  @MixedAudience(FREIGHT_PERMS.support.agentView)
   @ApiOperation({
     summary: "Download a support chat attachment",
     description:

apps/edr-freight-api/src/modules/support-chat/support-chat-agent.controller.ts

@@ -17,10 +17,12 @@ import {
 import { FilesInterceptor } from "@nestjs/platform-express";
 import { ApiBody, ApiConsumes, ApiOperation, ApiTags } from "@nestjs/swagger";
 
+import { BookingStaff } from "../../common/booking-guards";
 import {
   AuthUserPayload,
   resolveAuthUserId,
 } from "../../common/resolve-auth-user-id";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import {
   SUPPORT_ATTACHMENT_FIELD,
   supportAttachmentMulterOptions,
@@ -38,12 +40,14 @@ export class SupportChatAgentController {
   constructor(private readonly service: SupportChatService) {}
 
   @Get("conversations")
+  @BookingStaff(FREIGHT_PERMS.support.agentView)
   @ApiOperation({ summary: "List all support threads (shared inbox)" })
   list(@Query() query: ListConversationsQueryDto) {
     return this.service.listForAgents(query);
   }
 
   @Post("conversations")
+  @BookingStaff(FREIGHT_PERMS.support.agentSend)
   @ApiOperation({
     summary: "Start chatting with a company (returns the thread if one exists)",
   })
@@ -52,6 +56,7 @@ export class SupportChatAgentController {
   }
 
   @Get("conversations/:id/messages")
+  @BookingStaff(FREIGHT_PERMS.support.agentView)
   @ApiOperation({
     summary: "List messages in a thread (newest page first)",
     description:
@@ -67,6 +72,7 @@ export class SupportChatAgentController {
   }
 
   @Post("conversations/:id/messages")
+  @BookingStaff(FREIGHT_PERMS.support.agentSend)
   @UseInterceptors(
     FilesInterceptor(
       SUPPORT_ATTACHMENT_FIELD,
@@ -106,6 +112,7 @@ export class SupportChatAgentController {
   }
 
   @Post("conversations/:id/read")
+  @BookingStaff(FREIGHT_PERMS.support.agentView)
   @ApiOperation({ summary: "Mark a thread read (agent side)" })
   read(
     @CurrentUser() user: AuthUserPayload,
@@ -115,6 +122,7 @@ export class SupportChatAgentController {
   }
 
   @Get("unread-count")
+  @BookingStaff(FREIGHT_PERMS.support.agentView)
   @ApiOperation({ summary: "Count unread threads (agent side)" })
   unread(@CurrentUser() user: AuthUserPayload) {
     return this.service.unreadCount(

apps/edr-freight-api/src/modules/support-chat/support-chat.controller.ts

@@ -23,6 +23,7 @@ import {
   SUPPORT_ATTACHMENT_FIELD,
   supportAttachmentMulterOptions,
 } from "./attachment-upload.options";
+import { PortalCustomer } from "../../common/booking-guards";
 import { ListMessagesQueryDto } from "./dto/list-messages-query.dto";
 import { SendMessageDto } from "./dto/send-message.dto";
 import { SupportChatService } from "./support-chat.service";
@@ -34,6 +35,7 @@ import { SupportChatService } from "./support-chat.service";
  */
 @ApiTags("support-chat")
 @Controller("support")
+@PortalCustomer()
 export class SupportChatController {
   constructor(private readonly service: SupportChatService) {}